Adobe · Flash Player
CVE-2015-0310
Adobe Flash Player ASLR Bypass Vulnerability
Qué es
Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.
CISA: Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism.
Qué hacer
The impacted product is end-of-life and should be disconnected if still in use.
Plazo para las agencias federales de EE. UU.: 15 de junio de 2022
- Añadida a la lista de CISA
- 25 de mayo de 2022
- Publicada
- 23 de enero de 2015
- Gravedad
- Alto 7,8 CVSS 3.1
- Probabilidad de ataques en los próximos 30 días (EPSS)
- 15% entre el 3,3% superior de todas las vulnerabilidades conocidas
- Debilidad
- CWE-264
- Más detalles
- NVD · CVE.org · CISA
Todas las referencias (8)
- http://security.gentoo.org/glsa/glsa-201502-02.xml
- http://www.securityfocus.com/bid/72261
- http://secunia.com/advisories/62660
- http://secunia.com/advisories/62740
- http://www.securitytracker.com/id/1031609
- http://helpx.adobe.com/security/products/flash-player/apsb15-02.html
- http://secunia.com/advisories/62452
- http://secunia.com/advisories/62601
Más fallos explotados de Adobe
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 17 sept 2024 | Incorrect Default Permissions | Flash Player | Alto 8,8 | 11% |
| 17 sept 2024 | Code Execution | Flash Player | Alto 8,8 | 11% |
| 17 sept 2024 | Integer Underflow Vulnerablity | Flash Player | Alto 8,8 | 99,9% |
| 17 sept 2024 | Double Free Vulnerablity | Flash Player | Alto 8,8 | 25% |
| 8 jun 2022 | Memory Corruption | Flash Player | Alto 7,8 | 83% |
| 8 jun 2022 | Unspecified | Flash Player | Alto 7,8 | 64% |
| 8 jun 2022 | Memory Corruption | Flash Player | Alto 7,8 | 91% |
| 8 jun 2022 | Cross-Site Scripting (XSS) | Flash Player | Media 6,1 | 6,2% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.